FR
Product
framework
13
CVEs
0
On KEV
9.8
Max CVSS
3
New 30D
Severity mix
Critical 3High 4Medium 5Low 1
Watch
Add framework to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-27515 | 9.8 | Mar 5 | Laravel is a web application framework Affected: before 11.44.1; 12.0.0 before 12.1.1 |
| CVE-2021-43617 | 9.8 | Nov 14 | Laravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP content because Illuminate/Validation/Concerns/ValidatesAttributes.php lacks a check for… Affected: through 8.70.2 |
| CVE-2026-114509 New | 9.2 | Oct 21 | Laravel TokenGuard authentication bypass through non-string API credentials Affected: < 12.68.0; >= 13.0.0, < 13.29.0 |
| CVE-2026-48019 | 8.9 | Sep 4 | CRLF injection in Laravel's default email rule enables SMTP smuggling and spoofed-mail relay Affected: >= 13.0.0, < 13.10.0; < 12.60.0 |
| CVE-2020-19316 | 8.8 | Dec 20 | OS Command injection vulnerability in function link in Filesystem.php in Laravel Framework before 5.8.17 Affected: before 5.8.17 |
| CVE-2018-6330 | 8.8 | Mar 28 | Laravel 5.4.15 is vulnerable to Error based SQL injection in save.php via dhx_user and dhx_version parameters Affected: 5.4.15 |
| CVE-2024-52301 | 7.5 | Nov 12 | Laravel is a web application framework Affected: before 6.20.45; 7.0.0 before 7.30.7; 8.0.0 before 8.83.28; 9.0.0 before 9.52.17; 10.0.0 before 10.48.23; 11.0.0 before 11.31.0 |
| CVE-2026-114508 New | 6.5 | Oct 21 | Laravel relationship inclusion can trigger unauthorized data destruction Affected: >= 12.45.0, < 12.68.0; >= 13.0.0, < 13.27.0 |
| CVE-2024-13919 | 6.1 | Mar 10 | The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of route parameters in the debug-mode error… Affected: 11.9.0 before 11.36.0 |
| CVE-2024-13918 | 6.1 | Mar 10 | The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of request parameters in the debug-mode… Affected: 11.9.0 before 11.36.0 |
| CVE-2021-43808 | 6.1 | Dec 8 | Laravel is a web application framework Affected: before 6.20.42; 7.0.0 before 7.30.6; 8.0.0 before 8.75.0 |
| CVE-2022-40482 | 5.3 | Apr 25 | The authentication method in Laravel 8.x through 9.x before 9.32.0 was discovered to be vulnerable to user enumeration via timeless timing attacks with HTTP/2 multiplexing Affected: 8.0.0 before 8.83.24; 9.0.0 before 9.32.0 |
| CVE-2026-102279 | 3.1 | Sep 28 | Laravel: XSS in Debug Page Information Affected: < 12.69.0; >= 13.0.0, < 13.30.0 |
Showing 13